The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes standard development commands such as git, npm, yarn, pnpm, and tsc. It also invokes project-defined test and build scripts to verify changes. This behavior is expected and necessary for the skill's purpose.
[EXTERNAL_DOWNLOADS]: The skill utilizes the web-search tool to fetch changelogs, migration guides, and CVE information from external sources. This ensures the agent uses up-to-date information for upgrades, following best practices for dependency management.
[PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it ingests and processes content from external websites and local project metadata.
Ingestion points: Project configuration files (package.json, lockfiles), Git history (git log), and external documentation fetched via web-search (documented in SKILL.md and all workflow files).
Boundary markers: The instructions do not specify any delimiters or safety markers to isolate external data from the agent's control logic.
Capability inventory: The skill can execute shell commands through the project's package manager and build/test tools.
Sanitization: There is no evidence of sanitization or strict validation of external data before it is interpreted by the agent.

upgrade-dependencies